progmune-runtime 3.7.13 → 3.7.15

package/dist/frameworks/fiber-detector.test.js

@@ -1,10 +1,46 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 /**
  * fiber-detector.test.ts — Fiber 框架适配器规则回归（纯函数，无文件 I/O）
  */
 const vitest_1 = require("vitest");
 const fiber_detector_1 = require("./fiber-detector");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
 const app = (routes, extra = "") => `
 import "github.com/gofiber/fiber/v2"
 
@@ -55,3 +91,155 @@ func main() {
         (0, vitest_1.expect)(issues).toHaveLength(0);
     });
 });
+// ── V8 修复轮回归：窗口边界（单点摘保护不再被后续路由掩盖）──
+(0, vitest_1.describe)("fiber-detector V8 修复回归", () => {
+    (0, vitest_1.it)("窗口不跨路由串扰：下一路由的 Protected 不掩盖上一路由摘保护", () => {
+        const { issues, routes } = (0, fiber_detector_1.analyzeFiberApp)(app(`
+	api.Post("/logout", logoutHandler)
+	api.Post("/refresh-token", middleware.Protected(), refreshHandler)
+`));
+        const logout = routes.find((x) => x.path === "/logout");
+        const refresh = routes.find((x) => x.path === "/refresh-token");
+        (0, vitest_1.expect)(logout.protected).toBe(false);
+        (0, vitest_1.expect)(refresh.protected).toBe(true);
+        (0, vitest_1.expect)(issues.map((i) => i.route)).toContain("POST /logout");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST /refresh-token");
+    });
+    (0, vitest_1.it)("handler 名含 auth 词不误判（logoutHandler 不被当认证）", () => {
+        const { routes } = (0, fiber_detector_1.analyzeFiberApp)(app(`
+	api.Post("/logout", authHandler.Logout)
+`));
+        (0, vitest_1.expect)(routes.find((x) => x.path === "/logout").protected).toBe(false);
+    });
+});
+// ── Fiber 组认证跨文件传播（gin 同款模型移植）──
+const FBOOT = `package main
+import "github.com/gofiber/fiber/v2"
+func main() {
+	app := fiber.New()
+	api := app.Group("/api")
+	users.UsersRegister(api.Group("/users"))
+	api.Use(middleware.Protected())
+	users.UserRegister(api.Group("/user"))
+	articles.ArticlesRegister(api.Group("/articles"))
+}
+`;
+const FROUTERS = `package users
+import "github.com/gofiber/fiber/v2"
+func UsersRegister(router fiber.Router) {
+	router.Post("/login", UsersLogin)
+	router.Post("", UsersRegistration)
+}
+func UserRegister(router fiber.Router) {
+	router.Put("", UserUpdate)
+}
+`;
+(0, vitest_1.describe)("fiberProtectedRegisterFns 组认证相位", () => {
+    (0, vitest_1.it)("Use 之后的 Register 受保护，Use 之前的公开", () => {
+        const p = (0, fiber_detector_1.fiberProtectedRegisterFns)(FBOOT);
+        (0, vitest_1.expect)(p.get("UserRegister")).toBe(true);
+        (0, vitest_1.expect)(p.get("ArticlesRegister")).toBe(true);
+        (0, vitest_1.expect)(p.get("UsersRegister")).toBeUndefined();
+    });
+});
+(0, vitest_1.describe)("fiberEnclosingFunc 归属", () => {
+    (0, vitest_1.it)("按 func 头行号归属", () => {
+        // FROUTERS：1 package / 2 import / 3 func UsersRegister / 6 func UserRegister
+        (0, vitest_1.expect)((0, fiber_detector_1.fiberEnclosingFunc)(FROUTERS, 4)).toBe("UsersRegister");
+        (0, vitest_1.expect)((0, fiber_detector_1.fiberEnclosingFunc)(FROUTERS, 7)).toBe("UserRegister");
+    });
+});
+(0, vitest_1.describe)("analyzeFiberProject 跨文件传播", () => {
+    function makeProject(withUse) {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "fiber-proj-"));
+        const boot = withUse ? FBOOT : FBOOT.replace(/\s*api\.Use\(middleware\.Protected\(\)\)\n/, "");
+        fs.writeFileSync(path.join(dir, "main.go"), boot);
+        fs.writeFileSync(path.join(dir, "routers.go"), FROUTERS);
+        return dir;
+    }
+    (0, vitest_1.it)("Use 保护下跨文件 mutation 不报", () => {
+        const dir = makeProject(true);
+        try {
+            const a = (0, fiber_detector_1.analyzeFiberProject)(dir);
+            (0, vitest_1.expect)(a.issues.filter((i) => i.rule === "FIBER_ROUTE_NO_AUTH")).toHaveLength(0);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("删 Use → mutation 重现（敏感性保留）", () => {
+        const dir = makeProject(false);
+        try {
+            const a = (0, fiber_detector_1.analyzeFiberProject)(dir);
+            const routes = a.issues.filter((i) => i.rule === "FIBER_ROUTE_NO_AUTH").map((i) => i.route);
+            (0, vitest_1.expect)(routes).toContain("PUT "); // UserRegister mutation 重现
+            // POST "" 是 register（/login 姊妹佐证豁免，公开）——不报正确
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+});
+// ── 多层 Register 链（journalist 式 main→api(Group+Use)→v1→模块）──
+function makeNestedProject(withUse) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "fiber-nest-"));
+    const mk = (rel, content) => {
+        const fp = path.join(dir, rel);
+        fs.mkdirSync(path.dirname(fp), { recursive: true });
+        fs.writeFileSync(fp, content);
+    };
+    mk("main/main.go", `package main
+import "github.com/gofiber/fiber/v2"
+func main() {
+	app := fiber.New()
+	api.Register(app)
+}
+`);
+    mk("api/api.go", `package api
+import "github.com/gofiber/fiber/v2"
+func Register(fiberApp *fiber.App) {
+	api := fiberApp.Group("/api")
+${withUse ? "\tapi.Use(middleware.Protected())\n" : ""}\tv1.Register(&api)
+}
+`);
+    mk("v1/v1.go", `package v1
+import "github.com/gofiber/fiber/v2"
+func Register(router *fiber.Router) {
+	feeds.Register(router)
+}
+`);
+    mk("feeds/feeds.go", `package feeds
+import "github.com/gofiber/fiber/v2"
+func Register(router *fiber.Router) {
+	router.Post("/", CreateFeed)
+	router.Put("/:id", UpdateFeed)
+}
+`);
+    return dir;
+}
+(0, vitest_1.describe)("analyzeFiberProject 多层 Register 链（journalist 式）", () => {
+    (0, vitest_1.it)("api(Group+Use)→v1→feeds 链：跨层 mutation 不报", () => {
+        const dir = makeNestedProject(true);
+        try {
+            const a = (0, fiber_detector_1.analyzeFiberProject)(dir);
+            (0, vitest_1.expect)(a.issues.filter((i) => i.rule === "FIBER_ROUTE_NO_AUTH")).toHaveLength(0);
+            (0, vitest_1.expect)(a.protectedFunctions).toContain("feeds:Register");
+            (0, vitest_1.expect)(a.protectedFunctions).toContain("v1:Register");
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("删中间层 api.Use → feeds mutation 重现（敏感性穿透多层）", () => {
+        const dir = makeNestedProject(false);
+        try {
+            const a = (0, fiber_detector_1.analyzeFiberProject)(dir);
+            const routes = a.issues.filter((i) => i.rule === "FIBER_ROUTE_NO_AUTH").map((i) => i.route);
+            (0, vitest_1.expect)(routes).toContain("POST /");
+            (0, vitest_1.expect)(routes).toContain("PUT /:id");
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+});

package/dist/frameworks/gin-detector.js

@@ -54,7 +54,12 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.analyzeGinApp = analyzeGinApp;
 exports.analyzeGinFile = analyzeGinFile;
+exports.ginFuncStarts = ginFuncStarts;
+exports.ginProtectedRegisterFns = ginProtectedRegisterFns;
+exports.ginEnclosingFunc = ginEnclosingFunc;
+exports.analyzeGinProject = analyzeGinProject;
 const fs = __importStar(require("fs"));
+const route_window_1 = require("./route-window");
 const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
 const AUTH_ENTRY_WORDS = [
     "login", "signin", "sign_in", "regist", "signup", "sign_up",
@@ -84,24 +89,28 @@ function analyzeGinApp(code) {
         return { hasGin: false, routes, authGroupMiddleware, issues };
     }
     // 组级认证中间件：r.Use(authMW) / r.Group("/api", authMW) / g.Use(authMW)
-    const useRe = /\.Use\s*\(\s*([A-Za-z_][\w]*)/g;
+    // 捕获支持点限定成员（users.AuthMiddleware）——修复旧版只捕限定符
+    // "users" 的缺陷（V7）。整名送词表判定（AuthMiddleware 含 auth ✓）
+    const useRe = /\.Use\s*\(\s*([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)/g;
     let m;
     while ((m = useRe.exec(code)) !== null) {
         if (isAuthFnName(m[1]))
             authGroupMiddleware.push(m[1]);
     }
-    const groupRe = /\.Group\s*\(\s*"[^"]*"\s*,\s*([A-Za-z_][\w]*)/g;
+    const groupRe = /\.Group\s*\(\s*"[^"]*"\s*,\s*([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)/g;
     while ((m = groupRe.exec(code)) !== null) {
         if (isAuthFnName(m[1]))
             authGroupMiddleware.push(m[1]);
     }
     // 路由注册：r.POST("/x", mw1, mw2, handler)——Go 方法名大写（POST 惯例）
-    const routeRe = /\.(get|post|put|patch|delete)\s*\(\s*"([^"]+)"/gi;
+    // 空路径 "..." 允许（realworld 惯用 POST("", ...) 双注册）
+    const routeRe = /\.(get|post|put|patch|delete)\s*\(\s*"([^"]*)"(\s*,\s*|\s*\))/gi;
     while ((m = routeRe.exec(code)) !== null) {
         const method = m[1].toLowerCase();
         const pathName = m[2];
-        const window = code.slice(m.index + m[0].length, m.index + m[0].length + 300);
-        const mwNames = window.match(/[A-Za-z_][\w]*/g) || [];
+        // 认证窗口 = 本次调用边界内（括号感知），不跨路由（V7 缺陷修复）
+        const window = (0, route_window_1.routeCallWindow)(code, m.index + m[0].length);
+        const mwNames = (0, route_window_1.middlewareNamesFromWindow)(window);
         const hasAuthMw = mwNames.some((name) => isAuthFnName(name));
         routes.push({
             method,
@@ -109,15 +118,23 @@ function analyzeGinApp(code) {
             protected: hasAuthMw,
             line: code.slice(0, m.index).split("\n").length,
         });
-        if (MUTATION_METHODS.has(method) && !hasAuthMw
-            && authGroupMiddleware.length === 0 && !isAuthEntryPath(pathName)) {
+    }
+    // register 集合豁免（语义层，同 Koa）：有 <path>/login 姊妹佐证的
+    // 账户集合，其无认证 POST = 公开注册（gin realworld 用 POST "" /
+    // "/" + /login 双注册——路径豁免词表认不出）
+    const registerRoots = (0, route_window_1.collectRegisterRoots)(routes.map((r) => r.path));
+    for (const r of routes) {
+        if (MUTATION_METHODS.has(r.method) && !r.protected
+            && authGroupMiddleware.length === 0
+            && !isAuthEntryPath(r.path)
+            && !(r.method === "post" && (0, route_window_1.isRegisterRoot)(r.path, registerRoots))) {
             issues.push({
                 severity: "medium",
                 rule: "GIN_ROUTE_NO_AUTH",
-                message: `Route ${method.toUpperCase()} ${pathName} has no auth middleware ` +
+                message: `Route ${r.method.toUpperCase()} ${r.path} has no auth middleware ` +
                     `and no auth Use/Group middleware — any caller can reach it.`,
-                route: `${method.toUpperCase()} ${pathName}`,
-                line: code.slice(0, m.index).split("\n").length,
+                route: `${r.method.toUpperCase()} ${r.path}`,
+                line: r.line,
             });
         }
     }
@@ -131,3 +148,99 @@ function analyzeGinFile(filePath) {
         return null;
     return analyzeGinApp(code);
 }
+/** 顶层函数头（行号 1-based）——排除接收者方法（method receiver） */
+function ginFuncStarts(text) {
+    const out = [];
+    const re = /^func\s+([A-Za-z_]\w*)\s*\(/gm;
+    let m;
+    while ((m = re.exec(text)) !== null) {
+        out.push({ name: m[1], line: text.slice(0, m.index).split("\n").length });
+    }
+    return out;
+}
+/**
+ * 从 bootstrap 文本（含 gin.Default/New 的文件）推导：
+ * 哪些 Register 函数在「组已施加认证 Use 之后」被调用（其路由受保护）。
+ * 语句顺序敏感：Use 之前注册的（register/login）不算。
+ */
+function ginProtectedRegisterFns(bootstrapText) {
+    const state = new Map(); // 组变量 → 已认证
+    const protectedFns = new Map();
+    const re = /(\w+)\s*(?::=|=)\s*gin\.(Default|New)\s*\(|(\w+)\.Use\s*\(\s*([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)(?:\s*\(\s*(true|false))?|(\w+)\s*(?::=|=)\s*(?:[\w.]*\.)?([A-Za-z_]\w*)\.Group\s*\(|(?:[\w.]*\.)?([A-Z][A-Za-z0-9_]*)\s*\(\s*(?:[\w.]*\.)?([A-Za-z_]\w*)\.Group\s*\(/g;
+    let m;
+    // 组编号（按开括号序）：1,2 根组 | 3,4,5 Use | 6,7 子组 | 8,9 注册调用
+    while ((m = re.exec(bootstrapText)) !== null) {
+        if (m[1] !== undefined) {
+            state.set(m[1], false); // 根组：gin.Default/New
+        }
+        else if (m[3] !== undefined) {
+            // 组.Use(认证)；首参字面 false = 可选认证（public 读通行）不视为
+            // 保护——否则删掉 required Use 后 mutations 仍被可选 Use 掩盖（FN）
+            if (isAuthFnName(m[4]) && m[5] !== "false")
+                state.set(m[3], true);
+        }
+        else if (m[6] !== undefined) {
+            state.set(m[6], !!state.get(m[7])); // 子组继承父组状态
+        }
+        else if (m[8] !== undefined) {
+            if (state.get(m[9]))
+                protectedFns.set(m[8], true); // 认证相位调用的 Register fn
+        }
+    }
+    return protectedFns;
+}
+/** routeLine 所在顶层函数名（按 func 头归属） */
+function ginEnclosingFunc(text, routeLine) {
+    let name = null;
+    for (const f of ginFuncStarts(text)) {
+        if (f.line <= routeLine)
+            name = f.name;
+        else
+            break;
+    }
+    return name;
+}
+/** 项目级分析：跨文件组认证传播 + 文件级判定兜底 */
+function analyzeGinProject(projectRoot) {
+    const files = [];
+    // 简易 walk（.go，跳过 _test/vendor/node_modules）
+    const walk = (d) => {
+        for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+            if (e.isDirectory()) {
+                if (["vendor", "node_modules", ".git"].includes(e.name))
+                    continue;
+                walk(`${d}/${e.name}`);
+            }
+            else if (e.name.endsWith(".go") && !e.name.endsWith("_test.go")) {
+                const fp = `${d}/${e.name}`;
+                try {
+                    files.push({ file: fp, text: fs.readFileSync(fp, "utf-8"), a: analyzeGinFile(fp) });
+                }
+                catch { /* skip unreadable */ }
+            }
+        }
+    };
+    if (fs.existsSync(projectRoot))
+        walk(projectRoot.replace(/\/$/, ""));
+    // bootstrap：含 gin.Default/gin.New 的文件（组认证相位在此推导）
+    const bootstrap = files.find((f) => /gin\.(Default|New)\s*\(/.test(f.text));
+    const protectedFns = bootstrap
+        ? ginProtectedRegisterFns(bootstrap.text)
+        : new Map();
+    const issues = [];
+    for (const { file, text, a } of files) {
+        if (!a || a.issues.length === 0)
+            continue;
+        for (const issue of a.issues) {
+            const fn = issue.line ? ginEnclosingFunc(text, issue.line) : null;
+            if (fn && protectedFns.get(fn))
+                continue; // 认证相位注册 → 受保护
+            issues.push({ ...issue, route: issue.route });
+        }
+    }
+    return {
+        filesScanned: files.length,
+        protectedFunctions: [...protectedFns.keys()].filter((k) => protectedFns.get(k)),
+        issues,
+    };
+}

package/dist/frameworks/gin-detector.test.js

@@ -1,10 +1,46 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 /**
  * gin-detector.test.ts — Gin 框架适配器规则回归（纯函数，无文件 I/O）
  */
 const vitest_1 = require("vitest");
 const gin_detector_1 = require("./gin-detector");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
 const app = (routes, extra = "") => `
 import "github.com/gin-gonic/gin"
 
@@ -62,3 +98,150 @@ func main() {
         (0, vitest_1.expect)(issues).toHaveLength(0);
     });
 });
+// ── V7 修复轮回归：Use 点限定捕获 / 窗口边界 / 空路径 ──
+(0, vitest_1.describe)("gin-detector V7 修复回归", () => {
+    (0, vitest_1.it)("Use 点限定成员（users.AuthMiddleware）被识别为认证中间件（旧版只捕 'users'）", () => {
+        const { issues, authGroupMiddleware } = (0, gin_detector_1.analyzeGinApp)(app(`
+	v1 := r.Group("/api")
+	v1.Use(users.AuthMiddleware(true))
+	v1.POST("/pay", createPayment)
+`));
+        (0, vitest_1.expect)(authGroupMiddleware).toContain("users.AuthMiddleware");
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("窗口不跨路由串扰：后面路由的认证中间件不保护前面的公开路由", () => {
+        const { issues, routes } = (0, gin_detector_1.analyzeGinApp)(app(`
+	v1.POST("/users", UsersRegistration)
+	v1.POST("/articles", AuthMiddleware(), ArticleCreate)
+`));
+        const reg = routes.find((x) => x.path === "/users");
+        const art = routes.find((x) => x.path === "/articles");
+        (0, vitest_1.expect)(reg.protected).toBe(false);
+        (0, vitest_1.expect)(art.protected).toBe(true);
+        (0, vitest_1.expect)(issues.map((i) => i.route)).toContain("POST /users");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST /articles");
+    });
+    (0, vitest_1.it)("handler 名含 auth 词不误判为认证（UsersLogin 是 handler 不是中间件）", () => {
+        const { routes } = (0, gin_detector_1.analyzeGinApp)(app(`
+	v1.POST("/login", UsersLogin)
+`));
+        const login = routes.find((x) => x.path === "/login");
+        (0, vitest_1.expect)(login.protected).toBe(false);
+    });
+    (0, vitest_1.it)("空路径注册可见（realworld 惯用 POST(\"\", ...)）", () => {
+        const { routes } = (0, gin_detector_1.analyzeGinApp)(app(`
+	v1.POST("", UsersRegistration)
+`));
+        (0, vitest_1.expect)(routes.some((x) => x.path === "")).toBe(true);
+    });
+});
+// ── register 集合豁免（语义层）──
+(0, vitest_1.describe)("gin-detector register 集合豁免", () => {
+    (0, vitest_1.it)("有 /login 姊妹佐证：POST \"\"/\"/\"（公开注册双注册）不报", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`
+	v1.POST("", UsersRegistration)
+	v1.POST("/", UsersRegistration)
+	v1.POST("/login", UsersLogin)
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST ");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST /");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST /login");
+    });
+    (0, vitest_1.it)("POST-only：同根的 PUT 不豁免（user-update 类仍查）", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`
+	v1.POST("", UsersRegistration)
+	v1.POST("/login", UsersLogin)
+	v1.PUT("", UserUpdate)
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST ");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).toContain("PUT ");
+    });
+    (0, vitest_1.it)("无姊妹佐证：POST \"/users\" 仍报（管理员建用户不豁免）", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`
+	v1.POST("/users", AdminCreateUser)
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.route)).toContain("POST /users");
+    });
+});
+// ── V7 转正：组认证跨文件传播 ──
+const BOOTSTRAP = `package main
+import "github.com/gin-gonic/gin"
+func main() {
+	r := gin.Default()
+	v1 := r.Group("/api")
+	users.UsersRegister(v1.Group("/users"))            // Use 之前 → 公开
+	v1.Use(users.AuthMiddleware(false))                // 可选认证
+	tags.TagsRegister(v1.Group("/tags"))
+	v1.Use(users.AuthMiddleware(true))
+	users.UserRegister(v1.Group("/user"))
+	articles.ArticlesRegister(v1.Group("/articles"))
+}
+`;
+const ROUTERS = `package users
+import "github.com/gin-gonic/gin"
+func UsersRegister(router *gin.RouterGroup) {
+	router.POST("/login", UsersLogin)
+	router.POST("", UsersRegistration)
+}
+func UserRegister(router *gin.RouterGroup) {
+	router.PUT("", UserUpdate)
+	router.PUT("/", UserUpdate)
+}
+`;
+(0, vitest_1.describe)("ginProtectedRegisterFns 组认证相位推导", () => {
+    (0, vitest_1.it)("Use(true) 之后的 Register 调用受保护，Use 之前的公开", () => {
+        const p = (0, gin_detector_1.ginProtectedRegisterFns)(BOOTSTRAP);
+        (0, vitest_1.expect)(p.get("UserRegister")).toBe(true);
+        (0, vitest_1.expect)(p.get("ArticlesRegister")).toBe(true);
+        (0, vitest_1.expect)(p.get("UsersRegister")).toBeUndefined(); // Use 之前注册（register/login 公开）
+        (0, vitest_1.expect)(p.get("TagsRegister")).toBeUndefined(); // 仅可选 Use(false) 之下
+    });
+    (0, vitest_1.it)("可选认证 Use(false) 不视为保护（否则删 required 后被掩盖）", () => {
+        const p = (0, gin_detector_1.ginProtectedRegisterFns)(BOOTSTRAP.replace("v1.Use(users.AuthMiddleware(true))\n", ""));
+        (0, vitest_1.expect)(p.get("UserRegister")).toBeUndefined();
+        (0, vitest_1.expect)(p.get("ArticlesRegister")).toBeUndefined();
+    });
+});
+(0, vitest_1.describe)("ginEnclosingFunc 路由函数归属", () => {
+    (0, vitest_1.it)("按 func 头行号归属", () => {
+        const lines = ROUTERS.split("\n");
+        const lineNo = (i) => i + 1;
+        const fnAt = (text, ln) => (0, gin_detector_1.ginEnclosingFunc)(text, ln);
+        // ROUTERS：1 package / 2 import / 3 func UsersRegister … 7 func UserRegister
+        (0, vitest_1.expect)(fnAt(ROUTERS, lineNo(3))).toBe("UsersRegister");
+        (0, vitest_1.expect)(fnAt(ROUTERS, lineNo(7))).toBe("UserRegister");
+        (0, vitest_1.expect)(fnAt(ROUTERS, lineNo(1))).toBeNull(); // package 行无函数
+    });
+});
+(0, vitest_1.describe)("analyzeGinProject 跨文件传播", () => {
+    function makeProject(withRequiredUse) {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "gin-proj-"));
+        const boot = withRequiredUse ? BOOTSTRAP : BOOTSTRAP.replace(/\tv1\.Use\(users\.AuthMiddleware\(true\)\)\n/, "");
+        fs.writeFileSync(path.join(dir, "hello.go"), boot);
+        fs.writeFileSync(path.join(dir, "routers.go"), ROUTERS);
+        return dir;
+    }
+    (0, vitest_1.it)("Use(true) 保护下：跨文件 mutation 不报", () => {
+        const dir = makeProject(true);
+        try {
+            const a = (0, gin_detector_1.analyzeGinProject)(dir);
+            // UserRegister 的 PUT 受组认证保护（跨文件传播）
+            (0, vitest_1.expect)(a.issues.filter((i) => i.rule === "GIN_ROUTE_NO_AUTH")).toHaveLength(0);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("删掉 Use(true)：mutation 重新被报（敏感性保留）", () => {
+        const dir = makeProject(false);
+        try {
+            const a = (0, gin_detector_1.analyzeGinProject)(dir);
+            const routes = a.issues.filter((i) => i.rule === "GIN_ROUTE_NO_AUTH").map((i) => i.route);
+            (0, vitest_1.expect)(routes).toContain("PUT ");
+            (0, vitest_1.expect)(routes).toContain("PUT /");
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+});